In one breath
We collect what we need to interview someone, turn their answers into a book, and let you keep it. We never use your memoir content to train AI. You can export everything or delete it at any time. We don't sell your data.
1. Who we are
Told is a service that helps families turn a spoken life story into a finished, printed book — with the teller's own voice on every chapter. Told is operated by Esja Ventures Ltd ("Told", "we", "us"), a company registered in England & Wales. For the personal data described here, we are the data controller.
If you have any question about this policy or your data, contact us at [email protected].
2. The short version
- Your memoir content is never used to train AI models — not ours, and not a provider's.
- You own your words. The drafted prose and finished book are yours to keep, edit, and publish.
- You can take everything with you, and you can delete it — any time, from your account.
- We don't sell your personal data or share it for advertising.
3. What we collect
Information you give us
- Account details — your name and email address, and a securely hashed password (we never store the password itself). If you sign in with Google or Apple, we receive your verified email and name from them.
- Your story content — the questions asked, the answers you give (typed or spoken), any audio you record and upload, the AI-drafted chapters and summaries, and the structure of the book. This is the heart of the service and, by its nature, may include sensitive details about you and others.
- Contributor content — if you invite others to answer questions for a book, their answers to the topics you assign them.
- Communications — messages you send us (e.g. support requests, beta feedback).
- Payment information — when paid plans are active, our payment processor collects and processes your payment details. We do not store full card numbers on our servers.
Information collected automatically
- Basic technical data needed to run the service securely — e.g. your IP address (used for rate limiting and abuse prevention) and standard server request logs.
- Product metrics about how features perform (for example, how effective a question is, or edit distance between a draft and the final). These are measurements only — they contain no memoir text — and are de-identified when you delete your account.
4. Why we use your data, and our lawful basis
| What we do | Lawful basis (UK/EU GDPR) |
|---|---|
| Provide the service — interview, draft, assemble, and export your book | Performance of our contract with you. |
| Create and secure your account; prevent fraud and abuse (rate limiting) | Contract, and our legitimate interest in a secure service. |
| Process payments (when paid plans are active) | Performance of our contract with you. |
| Improve the product using de-identified metrics | Our legitimate interest in improving the service. |
| Respond to your messages and support requests | Legitimate interest / contract. |
| Meet legal obligations (e.g. accounting, lawful requests) | Compliance with a legal obligation. |
Because a life story can include special-category information (for example, about health, beliefs, or ethnicity), you provide that content on your own initiative to have it written into your book. Where required, our basis for processing such content is your explicit consent and the fact that you have manifestly chosen to include it in your memoir; you can withdraw it by editing or deleting the content or your account.
5. AI, and our no-training promise
Told uses AI to interview, organise, and draft. When you interview or generate a draft, the relevant content is sent to our AI providers to produce that result and return it to you. Your content is not used to train any model — we use these providers under commercial terms that prohibit training on your data, and we do not train on it ourselves.
AI-generated prose can be imperfect. Told is designed to shape what was actually said and never to invent facts, but you should review a draft before you rely on it or publish it.
6. Who we share your data with
We share personal data only with the service providers ("subprocessors") that make Told work, and only so they can perform their function. We do not sell your data, and we do not share it for advertising.
| Subprocessor | Purpose | Region |
|---|---|---|
| Anthropic (Claude) | Conducts interviews and drafts prose from your answers. Not used for training. | United States |
| OpenAI (Whisper) | Transcribes uploaded audio — only if you use record-and-upload. Audio deleted after transcription. | United States |
| Fly.io | Application and encrypted-database hosting. | Hosted on Fly's network |
| Payment processor | Processes payments when paid plans are active. | Depends on processor |
| Google (Fonts) & browser speech | Web fonts load from Google; live in-browser dictation, if you choose it, is handled by your browser's provider. | United States |
We may also disclose data if required by law, to protect our rights or someone's safety, or in connection with a merger or acquisition (in which case we'll tell you). Any successor would be bound by commitments at least as protective as these.
7. International data transfers
Some of our providers are based in the United States, so your data may be transferred and processed outside the UK/EEA. Where we do this, we rely on appropriate safeguards — such as the UK International Data Transfer Agreement / Addendum and the EU Standard Contractual Clauses, or an adequacy decision where one applies — so your data keeps a comparable level of protection.
8. How long we keep it
- Your account and story content — for as long as your account is active, so your book stays available to you. When you delete your account, we delete your content (see below).
- Uploaded audio — deleted immediately after transcription.
- Product metrics — retained in de-identified form and disassociated from you when you delete your account.
- Records we must keep by law (e.g. payment/accounting records) — retained for the period the law requires, then deleted.
- Backups — deleted content may persist briefly in encrypted backups before those backups rotate out.
9. Your rights
You have the right to access, correct, export, restrict, object to, and delete your personal data, and to withdraw consent where we rely on it. Most of this you can do yourself, immediately:
- Access & portability — from your account, download a complete, decrypted archive of your account and content.
- Correction — edit any answer, draft, or account detail directly in the app.
- Erasure — delete your account and everything you own. Where you contributed answers inside someone else's shared book, your name is removed rather than the words deleted, so their book survives.
- Object / restrict / withdraw consent — write to [email protected] and we'll action it.
We don't make decisions with legal or similarly significant effects about you using solely automated means. If you're in the UK or EU and think we've mishandled your data, you can complain to a supervisory authority — in the UK, the Information Commissioner's Office (ICO) — though we'd appreciate the chance to put it right first.
11. People named in your story
A memoir names relatives, friends, exes, and the departed. You decide what to include, and you're responsible for what you publish about living people. Before you print or share widely, consider anonymising anyone identifiable who is portrayed negatively. If someone asks us to address content about them in a book they don't control, we'll direct them to the account owner and, where the law requires, help facilitate a request.
12. Children
Told is intended for adults. Accounts and contributors must be adults who can consent to taking part. It's fine for a memoir to describe childhood or to include a family's children as part of the story — but don't use the product to collect a child's own information without a parent or guardian's involvement. If you believe a child has given us personal data directly, contact us and we'll remove it.
13. When something heavy comes up
The interview is designed to make room for difficult memories. If a session surfaces a crisis, the app is instructed to set the questions aside, respond with care, and point to help (such as the 988 Suicide & Crisis Lifeline in the US) — never to moderate, report, or refuse. We don't flag you or break the trust of the conversation.
14. How we protect your data
We encrypt the sensitive parts of your story at rest and serve everything over HTTPS, enforce strict ownership checks so only you (and contributors you invite) can reach your content, hash passwords with Argon2, and keep the encryption key separate from the database. The full detail is on our Security page.
15. Changes to this policy
As Told grows, we'll update this policy. When we make a material change, we'll update the "last updated" date and, for significant changes, notify you (for example, by email or in-app). Continuing to use Told after a change means you accept the updated policy.
16. Contact us
Privacy questions or requests: [email protected]. General enquiries: [email protected]. Told is operated by Esja Ventures Ltd, England & Wales.
See also our Terms of Service and Security page.